Fix a few potential integer negation overflows

src/arm64/lithium-codegen-arm64.cc

Index: src/arm64/lithium-codegen-arm64.cc
diff --git a/src/arm64/lithium-codegen-arm64.cc b/src/arm64/lithium-codegen-arm64.cc
index 0cc1dfc5bcb36b8cacdcd79cc7b6934040f87dda..19e9ec04caad4b817c978e46da325198fab81afc 100644
--- a/src/arm64/lithium-codegen-arm64.cc
+++ b/src/arm64/lithium-codegen-arm64.cc
@@ -4316,7 +4316,7 @@ void LCodeGen::DoMulConstIS(LMulConstIS* instr) {
   Register left =
       is_smi ? ToRegister(instr->left()) : ToRegister32(instr->left()) ;
   int32_t right = ToInteger32(instr->right());
-  DCHECK((right > -kMaxInt) || (right < kMaxInt));
+  DCHECK((right > -kMaxInt) && (right < kMaxInt));

[Sven Panne, 2015/04/15 12:33:33]

Hmmmm, why do we exclude -kMaxInt here? Shouldn't this be OK?

[Jakob Kummerow, 2015/04/15 12:40:24]

Nope, there are expressions like "-right" (line 4412) and "right - 1" (line
4401) below.

[Sven Panne, 2015/04/15 13:02:41]

Uh, oh... Looking at LChunkBuilder::DoMul for ARM64 (only on that platform, why
do we do things differently here???), we already enter undefined-behavior-land
when trying to compute the absolute value of kMinInt. :-P I think we need to fix
this, making sure that kMinInt, -kMaxInt etc. are handled correctly. Otherwise
I'm not sure that we don't hit this assertion, or if we're lucky, or if we
really never fail the DCHECK, or...

 
   bool can_overflow = instr->hydrogen()->CheckFlag(HValue::kCanOverflow);
   bool bailout_on_minus_zero =